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ABSTRACT 



A personal identification instrument is comprised of a 
substrate, and carried on the substrate: a photograph and/or 
a personal signature, personal information relating to the 
legitimate holder of the instrument, and an encrypted 
machine readable security code carried by the instrument, 
the code being comprised of a combination of digitized 
personal information and a digitized descriptor of the pho- 
tograph and/or personal signature. 

9 Claims, 4 Drawing Sheets 
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SECURE PERSONAL mENTIFICATION borders (e.g. the border between the United States and 

INSTRUMENT AND METHOD FOR Canada, the border between the United States and Mexico) 

CREATING SAME the cost of using such a system becomes prohibitive. 

TTiis is a continuation of application Ser. No. 08/197.199 5 SUMMARY OF TOE PRESENT INVENTION 

filed Feb. 16, 1994 now abandoned which is a continuation- The present invention provides a means for realizing a 

in-part of application Ser. No. 08/019,589, filed Feb. 19, personal identification instrument which has extremely high 

1993 now abandoned. security, and is virtually immune to falsification. There is no 

need for storage of massive amounts of any data at any 

FIELD OF THE INVENTION lO central location nor of transmission of any data; all of the 

ITiis invention relates to personal identificalion instru- verification data is carried on the instrument itself Each 

menls and in particular to an instrument and method of verification station need only contam a processor capable of 

creating such an instrument which has a high degree of P^^^sing an algorithm and a scanner for scannmg the 

security from fraud instrument and reading data from the instrument into the 

15 processor. 

BACKGROUND TO THE INVENTION In accordance with an embodiment of the invention a 

personal identification instrument is comprised of a 

Personal identity instruments are widely used in society, substrate, and carried on the substrate are a photograph 

e.g. passports, credit cards, driver's licences, bmldmg and/or a personal signature, personal information relating to 

passes, etc. Such mstrumenLs are very valuable, and there- 20 legitimate holder of the instrument, and an encrypted 

fore are often illegally fabricated or stolen and altered so that machine readable security code carried by the instrument, 

they can be used fraudulenUy by another person. Such an ^^^^ ^-^^ comprised of a combination of digitized 

mstrument ideally should be useless m the hands of another personal information and a digitized descriptor of the pho- 

P®^^"- tograph and/or personal signature. 

In order to make an instrument more difficult to counter- ^5 accordance with another embodiment of the invention, 

feit or use by another person, it bears the signature and ^ method of creating a personal identification instrument on 

sometimes a photograph of the owner of the mstrument. A ^^^^^ personal data and a picture and/or signature of a 

security guard, cashier, customs agent, etc. typically verifies legitimate holder are retained, is comprised of acquiring a 

the picture visually with the face of the user, sometimes aUo j-g^j^ representation of the picture and/or signature of 

requests a signature for comparison with the signature on the ^ legitimate holder of said instrument, extracting first feature 

instrument, and by that means verifies the authenticity of the ^^^^ ^^^^ ^^^^^^^ representation, reading the personal 

instrument. ^j^t^^ combining the feature data with the personal data into 

However such instruments are subject to fraud. It is a single data sequence and generating a security code by 

possible to make a fake instrument from a stolen document encrypting the sequence with a secret key, and affixing the 

or card containing a different photograph, matching the security code to the instrument to provide a substantially 

fraudulent holder. forgery-proof instrument. 

U.S. Pat. No. 5,027,113 describes a process and apparatus iMTROnurnON TO THE DRAWINGS 

for making a personal identification instrument which is ^^^^^ INTRODUCIION lO IHb URAWINOb 

subject to machine verification. An instrument according to 40 A better understanding of the invention will be obtained 

that patent is first made carrying e.g. indicia and/or a by reference to the detailed description below, in conjunc- 

photograph, and deviations from a standard of the outlines tion with the following drawings, in which: 

of at least some of the indicia (on a magnified scale) are pjQ 1 is an apparatus that can be used to read a personal 

stored in a memory. When an instmment is presented, a identification instmment 

machine reads the exact oulline of corresponding indicia. « ^ illustrates a face of an instrument in accordance 

Smce paper fibers, ink bleeds, etc. result m a different ^ embodiment, 

outhne than the original, the machme comparing the devia- , .„ ^ /. • , 

tion data with the originally stored outline deviation data can PJ^. 3 illustrates a face of an instrument m accordance 

result in the declaration of a fraudulent instrument. ^ embodiment, 

Similariy, for verification of a photograph, the entire 50 .^^l*^* V^'^^T!- ' '° accordance 

photograph is read by a camera. The variation of the ^^^^ ^ ^^''^ embodiment. 

distribution of grey levels in the image scanned by the F^G- 5 illustrates a face of an instrument m accordance 

camera, as compared with stored data describing the varia- with a fourth embodiment, and 

tion of the distribution of grey levels, stored from the FIG. 6 illustrates an imprinted carrier on which is 

original authentic photograph, can result in detection of a 55 imprinted an encoded matrix in accordance with another 

fraudulent instrument. embodiment of the invention. 

Unfortunately the system described in the patent requires DETAILED DESCRIPTION OF THE 

storage of a large amount of data for each instrument, which INVENTION 
becomes very large when photograph data arc stored. In 

addition, each verification station requires access to the 60 Turning first to FIGS. 2, 3. 4 and 5. a personal identifi - 

slored data. While the data can be stored in a centralized data cation iastrument is divid ed into three areas: area 1 which 

bank, verification requires the transfer of very large amounts ^ontains biographical data of the legitimate holder ofthe 

of data along transmission lines from the central data bank mstrument, a rea 2 which contains either or both ot a picture 

to the verification stations. Where there is a continuous flow and signatur e of the legitimate holder ofthe instrument, and 

of persons to be authenticated, for example where many 65 area 3 wtTicb contams authentication information. 

millions of passport-holding persons are subject to verifica- ^ rhe main difference between the embodiments of FIGS, 

tion at any of hundreds of border points spanning very long 2-5 is in the storage of the authentication information: in 
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FIG. 2 it is in the form of a two-dimensional bar code, in FIG. 1 illustrates in block diagram a typical system which 

no. 3 the information is stored in an integrated circuit chip, can be used to encode or authenticate the instrument. The 

in FIG. 4 it is stored in a magnetic stripe, and in FIG. 5 it is instrument 5 can be placed on a table 7 which is moved in 

stored in an OCR code. the directions of the arrow by means of motor driven rollers 

The design geometry of areas 1, 2 and 3 do not have any 5 9 or pulled by hand. As the table moves to the right, it carries 

significance in the present invention. They can be ananged the instrument 5 under scanner 11. The sampled image data 

in a book form or in a one or two-sided card form, depending is passed into processor 13, to which a display 15 is 

on the requirements of the application. connected. 

, The biographical data in area 1 should be in a human Many commercial scanners or video cameras can serve to 

readable form, that can be electro-optically read by vahda- acquire a digital representation of a surface of an instrument, 

tion equipment at the authentication station. The subject ^ ^^^^^^^ ^^^^ ^^^^^^^ ^^^^^^^ 

matter in areas 2 and 3 can be in human readable form but Hc Scanjet can be used. Such a scanner produces a 

should be in machine readable lorra. 1 . li 1 j l . ■ r .t. • 

r — : r — r — 7^ • c c grey level black and white image of the picture to a 

When producme the authentication information for area , . icnj * • u u • u t. u c j» u 

o J. uf t. 1 J u iju A u resolution to 150 dots per mch, which has been tound to be 

3, d ata bits fr om area 1 and area 2 should be passed through ^, . ^ r . ti 

a V encryption alg orithm to fo rm a sec urity ^ode which adequate for most app ications. However the present m 

.hnnlH he .fflved inTT^e oflhTf^ showD i n FIG^. ^vMM to include all possible means of acquiring 

TT^M^^S^^a^X, includmg colour data. 

Modern encryption algorithms such as symmetric or The processor executes algorithms, such as described 

asymmetric key systems can provide means for protecting below, to extract data from the photograph. It may be 

the data stored in area 3. Even though such algorithms necessary, for some applications to include algorithms to 

become public domain, it is extremely difficult for someone find the location of the picture due to placement inaccura- 

to decode the data without knowing the secret key used in ^i^s. 

the encryption. Millions of years of computer time have ^lle algorithm extracting the information from the picture 

been estimated to be required to break some of the encoding is preferred to extract global features from the picture, i.e. 

schemes. The particular encoding scheme used is not par- ^ not local to any specific position in the picture but which 

ticular to this invention, so long as it is encrypted. depend on its overall characteristics. These features make 

Since the encoded information is dependent on the pho- very little assumptions regarding the contents of the image, 

tograph and other information on the instrument, it is so that they will still work if the image does not contain a 

extremely difficult to alter the information or photograph on 3^ face. However the algorithm is preferably optimized for the 

the instrument without escaping detection, even though the more usual situation where the photograph does contain a 

method of validating the instrument may be known to the face. About 10 features are preferred to be extracted, which 

public. For example, it would be next to impossible for a are encoded as small numbers. Concatenating the bits of 

person to generate a new encrypted code for the instrument these features produces a 50 to 128 bit number which is 

based on modified information on the instrument without 35 associated with the photograph. 

knowing the secret key used by the encryption scheme. The features are preferably computed by taking weighted 

It would be difficult to generate a photograph of a person averages. As the weighting functions are highly non-linear, 

with the same information that is embedded in encrypted it is very difficult to create an image which would have the 

information affixed to the card. It is likely that the new same averages and yet the image contain a face or signature 

photograph would be obviously different from the desired of a specific person. These features are only based on the 

holder of the instrument and furthermore, the name, age and luminance (black and white) components of the picture; 

height (blometric information) of the person encoded also however the present invention is not restricted and could 

likely would not match. cover colour components if this were necessary or desirable. 

The number of bits contributed by area 2 to area 3 in Any generic scheme for extracting local or global features 

accordance with one embodiment of this invention is in the 45 from a picture can be used. 

order of 100 bits. The contribution from area 1 to area 3 can One specific algorithm will be described in more detail 

be from a few bits to thousands of bits. If the information below. 

output of the biographical area is too large to fit into the bit The next step in the process is to input other personal 

space allocated in the authentication area, the information information for area 1, such as the age, height, colour of 

can be passed through a one way cryptographic hash func- 50 eyes, birth date, birth place, etc. of the authentic holder of 

tion to limit this contribution to allocated bit space. the instrument. This is preferably read from an imprint 

The tamper proof instrument can be copied or transmitted; already on the card, although instead it could be input on a 

if the copies are of high quality (reproduction of colour, keyboard. Ideally, the information should describe unalter- 

resolution, dimensions, brightness, contrast, etc.), then the able properties of the person. The validation machine could 

copies will have the same attributes as the original. Copies 55 display this information to the validation station user if a 

can be authenticated since no alterations will have been one-way hash function is not used, 

made on them. Indeed, the whole document can become The image is applied to the document by direct recording 

image area 2, and there may be no contribution from area 1; or by attachment of image material to the instrument. The 

or vice versa, full contribution from area 1 and no area 2, image that is part of the instrument in area 2 is recorded in Xy 

area 3 will constitute the descriptor of the whole document. 60 human visible form and is acquired by the electro-optical 

As one example, area 3 can contain 640 bits. Where, for means (e.g. by the scanner) from the instrument, 

example, as in FIG. 2 the information stored in area 3 is in The combination of the personal information and a digi- 

the form of a two-dimensional, high density, bar code, 640 tized descriptor oLthe photograph and/or personal informal 

bits can be stored in an area occupied by a postage stamp. tion forms a co de, w hich after encryptins using a secret key ^ 

'ITiis can be divided to store 128 bits of the image (area 2) 65 ,is recorded i n area _3 on the instrument in any reliabl e 

and 496 bits from the biographical data (area 1) plus 16 bits machine rea dabl e form, for exangple any of the form s shown 

I of error protection. in H(jS. 2-5. ' 
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The encryption algorithm used in processor 13 can use distinguishing nearly similar pictures) and robustness to 

private and/or public key encryption techniques. These environmental changes that can occur due to the changes in 

techniques are well known in literature; examples are Data the photograph or scanner. 

Encryption Standard (DES) for private key and Rivest It has been found that the digitization of a picture by a 
Shamir Adlcman (RSA) algorithm for public key tech- 5 scanner is not a repeatable operation. On a gross scale the 

niques. digitized pictures should appear the same, but in the fine 

The* resulting personal identification instrument is as ^^ere will be small variations for various practical 

shown in FIGS 2-5 reasons. For example, it is unlikely that the position of the 

^ , . * * . . . . , picture will be exactly the same due to the various mechani- 

To authenticate the mformation, a system such as that tolerances in the scanning equipment, 

shown in FIG. 1 can be used. Tlie instrument 5 is placed on ^^^^^^^ -^^^^^ ^„ identification card or pass- 

table 7 and is passed under scanner 11. Jhc biographical ^^^^ probably be scanned on many different authenti- 

\/ information is acquired from the recorded area 1 of the nation machines, lliese machines may be produced by 

document, and is converted into binary format in processor different manufacturers using different components. 

13 as was done in the document creation process and is Furthermore, machines of the same manufacturer may differ 

saved in a local memory. or depart from standard calibration due to aging and use. 

The image in area 2 of the instrument is acquired in a This will introduce other variations in the digitized data, 

similar manner, and is processed by the image processing Exposure of colour photographs to ultraviolet rays also 

algorithm, to extract image descriptors. It is preferred that causes slow fading of the picture. 

this is done by calculating weighted averages, as will be Many parts of the picture may contain useless informa- 

described below. The image descriptors are also saved in a tion. For example, a person in the photograph typically is in 

local memory. front of a featureless background. Although the encoding 

The information stored in area 3 is read and is decrypted technique may use some of the information in the 

using the public decryption key. The binary vector resulting background, it should provide greater weight to the fore- 

from the decryption is separated into two parts. The part ground information. 

containing the biographical data is compared to the bio- Photographs in passports are in many cases black and 

graphical data that was read from the area 1 of the while. Black and white pictures provide more definition and 

^ instrument, and if there is any discre pancy btrtwrrn th^ tw^ are more robust to environment changes. It is preferred in 

sets of biographical data streams, the document is declared the present invention, to convert all scanned pictures to 

as a fake. black and white. The conversion of colour photographs to 

If the biographical data test is positive, then a distance black and white often results in loss of contrast. The feature 

measure is applied between the image descriptor that is extraction technique used in the present invention should be 

generated at the authentication stage, and the decrypted robust enough to handle this loss in contrast, 

image descriptor from the information stored in area 3. If the H is preferred that the feature extraction, both in the 
distance measure is greater than a predetermined limit, the 3^ encoding system and in the decoding system should follow 

document is declared as a counterfeit. the following preferred steps. 

Clearly if the image has been altered or if the data stored The image should be acquired by electro -optical means, 

in area 1 of the instrument has been changed, this will not The resolution of the scanned image should be reduced to 

match the decrypted codes stored in area 3. A forger would about 100 dots per inch if it were digitized at a higher 

be unable to produce a correctly matching code for appli- resolution. If the digitized picture is in colour, the luminance 

cation to area 3, since the encryption key is secret. Even if component should be extracted and the hue and saturation 

the encryption and decryption algorithms are known, the components discarded. 

correct code for area 3 would not be able to be produced. The area of the digitized document where the photograph 

since the key used in generation of area 3 remains a secret. is located should be determined. The picture could always be 
The aforenoted one-way hash function, (which is also 45 located in one place, to a high tolerance, or the position 

known as a message digest algorithm or manipulation dctec- could be located automatically, either from datum points or 

tion code), is a message of variable length and provides a from an analysis algorithm. 

fixed length code. It appears to be computationally infea- The digitized image should then be converted from as 

sible to find two different messages with the same output many grey levels as the equipment provides (e.g. typically 
V code, if this code is larger than 64 bits. With this property, 50 256), to 3 grey levels. The weighted averages of the dark 

if the input is altered in any way, it will be delected by a component in the multi-tone average should then be com- 

mismatch of the output code generated. 'Ilie detection pro- puted. 'Ilie weighted averages of the light component in the 

cess in the authentication station is required only to detect multi-tone image should then be computed. 'Ilie averages 

the presence of the manipulation, but not the location or should then be encoded into a number with a fixed number 
magnitude or of the manipulation. 55 of bits. 

With regard to the photograph, such a photograph on an One way of digitizing the pic ture is to represent it as a 

identification card is typically 1" by VA". Digitized to a two-dimensional array ot' numtjg'is ui pixels wlldre t he 

resolution of 300 dots per inch in three colours, this would dimensions of the array depend on the size of* the picture. L et 

cause the picture to occupy 300x375x3x8-2.7 million bits, P(i j) denote the value of that pixel located at the i-lh row 
Even using shades of grey, the amount of data representing 60 and j-th column of this array. In a successful prototype 

a photograph is huge. The prior art U.S. Pat. No. 5,027,113 system, the dimensions of the array were 64 by 64, which 

referred to above requires the storage and transmission of was achieved by a suitable selection for scanning parameters 

bits of a photograph of this magnitude for every expected and by cropping the edges of the picture. Each pixel element 

instrument to be verified. took a value between 0 and 255 where low values denoted 

ITie present invention dispenses with verification of the 65 a dark pbccl and high values denoted a bright pixel, 

entire photograph, and instead utilizes selected features. To correct the continuous tone image to a three tone 

Different features differ in the amount of sensitivity (for image, each pixel in the array P(ij) was assigned a new 
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value, either 0, 1 or 2 depending upon the original value of the personal identification instrument, which has been read 

that pixel. The 0 value was assigned to all dark pixels whose by the authentication system. 

original intensity level lay within a range of 0 to TURl The square Euclidean distance is then compared with a 

inclusive where THRl is some threshold value selected. The threshold limit, in order to provide an accept or reject 
2 value was assigned to all bright pixels whose intensity 5 indicationof the instrument as being genuine or fake, e.g. as 

level lay between TIIR2 and 255 inclusive where TIIR2 is on display 15 or by other means. 

a higher threshold. The 1 value was assigned to all the 'l^e security code can contain combined data from areas 

remaining pixels. 1 and 2 of the instrument into the security code or from 

The choice of these thresholds THRl and THR2 depends ins'ninient can carry only area 1 or 2 data, 

upon the specific image and the manner in it was scanned. 10 2 data can be comprised of the image descr.p- 

jT ° J j/rjj\*» tors of the whole instrument, whatever imprmt is earned 

As some pictures are over or under exposed (or faded), it thereon 

was necessary to make some allowance. It may be necessary , r • * ^ - ... . . 

,f,.rr . uj uu Using the present invention no communication IS required 

to compensate for different scanning hardware which may , . .t. j * i j . i_ 

. I I . . rr 1 • . between the authentication and a central database. The cost 

be cahbrated differently, in other systems. authentication stations are relatively low, and being 

The thresholds were chosen so that one third of the pixel only as complex as present day widely-available personal 

elements in the picture were assigned to each of the three computers. The personal identification instruments are vir- 

categories 0, 1 and 2. This was accomplished by computing tually immune from tampering and falsification, and have 

a histogram of the pixel values in the digitized picture P(i,j) been found to be very robust in testing, showing a very low 

and by finding the levels which divided the distribution into false-negative and false-positive instance, 

approximately 3 equal parts. ^0 accordance with another embodiment of the invention. 

The spatial distribution of all the pixels assigned to the a personal identification instmment is created in which a 

zero category was analyzed. For example one can compute photo of the legitimate holder is incorporated with bio- 

the mean, variance and correlation of the i and j-th spatial graphical data into an encoded, encrypted file. The image is 

coordinates of all the pixels assigned to this category. first digitized and compressed into a file which can repro- 

(Recall that i and j address the row and column number of duce a recognizable likeness in about 900 bytes of data. The 

the pixels in the digitized picture.) The parameters that were biographical data is appended to the image forming a file of 
used were the weighted averages of the i-th coordinate, the ' about 1000 bytes. Error correction bits are added producing 

j-th coordinate and the product of the i-th and j-th coordi- a file of about 1400 bytes. The file is encrypted using the 

nates. Two different weighting functions were used to obtain secret key of a public k ey encryption scheme in which the 

6 averages— three for each weighting function. I cey used is about 600 bits. T he encrypted data is printed on 

The weighting functions serve two purposes. The first a carrier 19 as a matrix 20 of black and white rectangles^ 

weighting function gives the pixels located in the central using a laser pri nter, representing the binary number, as 

part of the picture more weight. For example, the face is shown in FIG. 6 . The 1400bytesof data, and thus the printed 

usually centered in the picture and it is the component of the area, can occupy an area of about 6 to 8 square inches. No 

picmre which is most difficult to modify without escaping photograph is printed on the carrier, nor biographical data 

detection. The weighting function also serves the purpose of although it may be desired to imprint the owner's name in 

making it more difficult for someone to tamper with the some circumstances. 

image in order to get a specific set of six spatial parameters. To check authenticity, a verification station is used. The 
The weighting functions were based on the harmonic verification station is comprised of a scanner connected to a 
functions sine and cosine. The first weighting function desk top compu ter. The matrix 20 is first scanned into the 
represents the first half of the sine wave (from zero to 180 computer and converted to a binary number. Next, an error 
degrees). The second weight function represents the full sine correction procedure is applied to remove scanning errors, 
wave from zero to 360 degrees. Hence the second weighting This process will overcome disfigurement of the matrix due 
function is non-symmetric across the image and contains 45 to usage (e.g. discoloration due to handling, pencil marks 
negative weights. To compute the weights the i-th and j-th and staple holes). 'ITie error corrected file now is comprised 
coordinates were converted to two angles by dividing them of about 1000 bytes, ^yhich is then decrypted using the 
by 64 (the weight of the picture) and then multiplying them public key . The information after decryption is displayed on 
by 180 or 360. the monitor of the computer. The displayed likeness of the 
The averages of the i-th and j-th coordinates must lie in a 50 legitimate holder and the displayed biop raphicfll data can he 
fixed range (-64 to +64). In actual practice it was found that used to check against the person to ensure authenticity^ 
they lie in a smaller range. The average of the i*j-th product Forgery and tampering with the photo or the data con- 
is divided by 20 to confine them to a smaller workable range. lained in the matrix is not possible unless the secret key is 
In fact, each of these parameters can be encoded in a single known to the forger. 

8 bit byte. There are 12 parameters, so 96 bits were used to 55 A person understanding this invention may now conceive 

encode the characteristics of the image. of alternative structures and embodiments or variations of 

Jn the instrument creation proces s, the fixed num ber, the above. All of those which fall within the scope of the 

which is a digitized descript or of the photo graj h (and/or claims appended hereto are considered to be part of the 

personal signature if used)~ is then combineci with the present invention. 
digitized personal information or c ode resu lting from the 60 We claim: 

nasn Function processed personal information , is encrypted 1. A method of creating a personal identification instru- 

and IS Kxcd to the card in area 3 in e.g. o ne of the forms ment on which personal data and at least one of a picture and 

shown in FIGS. 2-5. signature of a legitimate holder are retained, comprising the 

If the process is being used at an authentication station, steps of: 
the square Euclidean distance is computed between the 65 (a) acquiring a first digital representation of at least one of 

decoded information obtained from area 3 and the image a picture and signature of said legitimate holder of said 

descriptor generated from the digitized image of area 2 of instrument. 
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feature 



10 



data from said digital 



(b) extracting first 
representation, 

(c) combining said feature data with said personal data 
into a single data sequence, 

(d) generating a security code by encrypting said single 
data sequence using a private secret key of a kind for 
which decrypting using a public key would allow 
authentication of the instrument, and 

(e) affixing the personal data, and said at least one of a 
picture and a signature of a legitimate holder and said 
encrypted security code to the instrument to provide a 
substantially forgery-proof instrument. 

2. A method as defined in claim 1, in which the security 
code is fixed to the instrument in at least one of a machine 
readable bar code, a machine readable magnetic stripe, a 
machine readable integrated circuit and an OCR code. 

3. A method as defined in claim 1 in which said first 
feature data is a code resulting from the low resolution 
luminance component of said picture reduced to a small 
number of gray levels. 

4. A method as defined in claim 1, in which said feature 
data is a low resolution luminance component of a picture 
reduced to a small number of grey levels. 

5. A method as defined in claim 4, in which the number 
of grey levels is three. 

6. A method as defined in claim 4 in which the feature data 
is comprised of the binary coded weighted averages of each 
of the grey levels for each of i-th and j-th coordinates of the 
picture, more weight being given to pixels at the center of 
the picture. 

7. A method as defined in claim 1 in which said scctirity 
code is comprised additionally of error correction bits. 

8. A method of authenticating a personal identification 
instrument comprising a substrate, and carried on the sub- 
strate: a photograph and a personal signature, readable 
personal information relating to the legitimate holder of the 
instrument, and a private secret key encrypted machine 
readable security code, the private secret key being of a kind 
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for which decrypting using a public key would allow authen- 
tication of the instrument, said code being comprised of a 
combination of a digitized form of said personal information 
and a digitized descriptor of a first feature data of said 
photograph, comprising: 

i reading said personal data from the personal identifica- 

tion instrument, 

ii acquiring a second digital representation of the photo- 
graph from said instrument, 

iii extracting second feature data fi"om the digitized rep- 
resentation corresponding to said first feature data of 
said photograph, 

iv processing the second feature data to obtain image 
descriptors, 

v reading and decrypting the security code using a public 
decryption key, 

vi separating personal data from feature data in the 
encrypted security code, 

vii comparing the personal data obtained in step vi with 
the personal data read in step i, 

viii in the event there is a discrepancy, between the 
personal data from step vi compared to step i, declaring 
the instrument as a fake, 

ix in the event the instrument is not declared as a fake in 
step viii, obtaining decrypted image descriptors from 
the decrypted security code and comparing decrypted 
feature data descriptors obtained in step iv with the 
decrypted image descriptors, 

x declaring the instrument as a fake in the event the 
compared descriptors in step ix and step iv are dissimi- 
lar to a predetermined degree. 

9. A method as defined in claim 8 in which said machine 
readable security code is comprised of a compressed digi- 
tized representation which has been encrypted. 
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